The Optimal Defense of Network Connectivity 1

Transcription

1 The Optimal efense of Network Connectivity 1 an Kovenock 2 and Brian Roberson 3 November 12, Earlier versions of this paper circulated under the titles Terrorism and the Optimal efense of Networks of Targets and The Optimal efense of Networks of Targets. We have benefited from the helpful comments of Kai Konrad, aniel G. rce, and participants in the 15th SET Conference in Cambridge. The authors, of course, remain solely responsible for any errors or omissions. 2 an Kovenock, Economic Science Institute, rgyros School of Business and Economics, Chapman University, One University rive, Orange, C US t: kovenock@chapman.edu 3 Brian Roberson, Purdue University, epartment of Economics, Krannert School of Management, 403 W. State Street, West Lafayette, IN US t: brobers@purdue.edu Correspondent

2 bstract Maintaining the security of critical infrastructure networks is vital for a modern economy. This paper examines a game-theoretic model of attack and defense of a network in which the defender s objective is to maintain network connectivity and the attacker s objective is to destroy a set of nodes that disconnects the network. The conflict at each node is modeled as a contest in which the player that allocates the higher level of force wins the node. lthough there are multiple mixed-strategy equilibria, we characterize correlation structures in the players multivariate joint distributions of force across nodes that arise in all equilibria. For example, in all equilibria the attacker utilizes a stochastic guerrilla warfare strategy in which a single random [minimal] set of nodes that disconnects the network is attacked. JEL Classification: C7, 74 Keywords: llocation Game, symmetric Conflict, ttack and efense, Colonel Blotto Game, Network Connectivity, Weakest-Link, Best-Shot

3 1 Introduction In the literature on game-theoretic models of attack and defense there has been a growing interest in the attack and defense of networks of targets. One focus of the work on the strategic role of network structure in this context is the role that strategic complementarities among targets play in creating structural asymmetries between the attack and defense of a network. For example in complex infrastructure networks such as communication systems, electrical power grids, water and sewage systems, oil pipeline systems, transportation systems, and cyber security systems there often exist particular targets or combinations of targets which if destroyed would be sufficient to disconnect the network and create a terrorist spectacular. The focus of this article is on strategic behavior in the attack and defense of network connectivity. network or graph is connected if there exists a path between every pair of nodes. Similarly, a network is k-connected if there exist at least k internally disjoint paths i.e. paths that do not share internal nodes between every pair of nodes. Note that connectivity provides a measure of the robustness of a network with respect to node failure/destruction in that a k-connected network remains connected when any k 1 nodes are destroyed. Connectivity is a classic graph theory problem, dating back to Menger s 1927 work on cuts and internally-disjoint paths. 1 In our game of attack and defense of network connectivity, the defender s objective is to maintain network connectivity and the attacker s objective is to successfully attack a set of nodes that disconnects the network. Note that each minimal set of nodes that disconnects the network known as a minimal cut set or minimal separator and by minimal it is meant that no proper subset of the minimal cut set disconnects the network may be thought of as possessing best-shot redundancy in that the minimal cut set is successfully defended if and only if the defender successfully defends at least one node within the set. 2 Conversely, the network may be thought of as having weakest-link exposure in that the network is successfully defended if and only if the defender successfully defends all minimal cut sets within the network. We examine properties arising in the set of Nash equilibria of a simultaneous-move game of attack and defense of a network. Each node in the network is vulnerable to attack and at each node the conflict is modeled as a deterministic contest in which the player who allocates the higher level of force wins the node with probability one. In this game the attacker s 1 For further details, see Ford and Fulkerson See Hirshleifer 1983, who coins the terms best-shot and weakest-link in the context of the voluntary provision of public goods. 1

4 objective is to maximize the product of the probability of disconnecting the network by winning at least one cut set and his payoff for the successful attack of at least one cut set, v, net of the expenditure on forces, which are allocated at a constant unit cost. Conversely, the defender s objective is to maximize the product of the probability of maintaining connectivity and his payoff for maintaining connectivity, v, net of his expenditure on forces, also allocated at constant unit cost. distinctive feature of this environment is that a mixed strategy is a joint distribution function in which the randomization in the force allocation to each node is represented as a separate dimension. pair of equilibrium joint distribution functions specifies not only each player s randomization in force expenditure to each node, but also the correlation structure of the force expenditures across the node set. We construct a Nash equilibrium pair of distribution functions and, in the case in which the network has disjoint minimal cut sets, completely characterize the unique set of Nash equilibrium univariate marginal distributions and the unique equilibrium payoff of each player. Furthermore, we show that in any equilibrium the attacker launches an attack on at most one minimal cut set. Similarly, the defender randomly chooses one node from each minimal cut set to defend. Noting that a network is connected if and only if the network contains a spanning tree a subgraph of the network that is a tree and contains all of the nodes of the tree, the defender s equilibrium strategy may be interpreted as choosing a random spanning tree to defend, where the spanning tree is implicitly determined by the choice of the one node in each minimal cut set that is defended. Closely related is the literature on sequential-move models of the attack and defense of a network of targets such as ziubiński and Goyal 2013a, b. 3 In the two-stage game examined in ziubiński and Goyal 2013a the defender moves first and chooses which nodes to defend, where defense is perfect in the sense that a defended node survives an attack with probability one. Then, the attacker observes which nodes have been defended and chooses which nodes to attack. ny undefended node that is attacked is destroyed with probability one. Note that the defender is an exogenously imposed leader implying that the attacker s 3 See also Goyal and Vigier 2014 who examine a zero-sum model of the attack and defense of a network of targets with contagion in which the conflict at each node is determined by the Tullock contest success function. lso related are sequential-move reliability-theoretic models such as Bier, Oliveros, and Samuelson 2007, and Powell 2007a, b. In these models, defensive resources increase the stochastic reliability of a target in the event of an attack, the defender s payoff is additive with respect to the values of the surviving targets, and it is exogenously specified that the attacker uses a guerrilla warfare strategy consisting of an attack on a single target. In the case in which the defender has private information concerning the vulnerability of the individual targets, as in Powell 2007b, this sequential-move structure gives rise to an interesting signaling problem in that the defender would like to protect the most vulnerable targets but does not want to signal to the attacker which targets are the most vulnerable. 2

5 force allocations can be made contingent on the defender s allocation. In equilibrium, the defender chooses either to protect the minimum set of nodes that ensures the survival of a spanning tree, or to leave the network undefended. In ziubiński and Goyal 2013b the defender first designs the network and allocates defensive resources across nodes, where defense is again assumed to be perfect. Then, the attacker chooses an exogenously specified number of nodes to attack at zero cost. lthough these papers simplify the conflict at each node by focusing on the case of sequential moves and perfect defense, these models feature a rich network structure that, in addition to providing insights on the connectivity problem, allows for a general value function for the residual network and provides insight into the defender s choice of network structure. In contrast, our simultaneous-move model is motivated by applications such as information or transportation network defense or border defense, where attackers must either take actions before being certain of the allocation of defensive resources or where strategies like random monitoring or deployment may be employed by defenders and, thus, defensive resources can either be concealed or randomly allocated with sufficient speed that it is difficult to argue that attacker allocations can be made contingent on defensive allocations. lthough we take the network as given and restrict our focus to only the connectivity problem, we allow for a contest structure with nontrivial conflict at each node that results in rich equilibrium behavior in which mixed strategies involve multivariate joint distributions specifying the force expenditure to each node and the correlation structure of the force expenditures across the node set. Furthermore, by endogenizing the attacker s entry and force expenditure decisions, our approach sheds light not only on the conditions under which the assumption of one attack is likely to hold, but also related issues such as how the defender s actions can decrease the number of attacks. Our results on endogenous force correlation structures in games of attack and defense are closely related to the literature on the classic Colonel Blotto game. 4 Originating with Borel 1921, the Colonel Blotto game is a two-player game in which each player allocates his fixed level of forces across a finite number of battlefields, within each battlefield the higher allocation wins, and each player maximizes the number of battlefield wins. s in our game of attack and defense, a mixed strategy is a joint distribution function. However, in the Colonel 4 Recent work on Blotto-type games includes extensions such as: asymmetric players Roberson 2006, Hart 2008, Weinstein 2012, ziubiński 2013, Macdonell and Mastronardi 2015, non-constant-sum variations Kvasov 2007, Hortala-Vallve and Llorente-Saguer 2010, 2012, Roberson and Kvasov 2012, alternative definitions of success Golman and Page 2009, Tang, Shoham, and Lin 2010, Rinott, Scarsini, and Yu 2012, and political economy applications Laslier 2002, Laslier and Picard 2002, Roberson 2008, Thomas

6 Blotto game it is the budget constraint that creates a linkage between the force allocations to the individual battlefields. llocating force to a specific battlefield reduces the level of forces that can be allocated to other battlefields. Conversely, the linkages in our game of attack and defense arise because of the definition of success for each of the players. 5 There are a number of related games that display similar objective-based linkages. For example, Szentes and Rosenthal 2003a examine the so-called chopstick auction in which three identical objects are separately, but simultaneously, auctioned and each of two players wins a fixed prize of known and common value if and only if he wins at least two of the three objects. The player placing the highest bid on a given object wins the object. Szentes and Rosenthal examine both winner-pay and all-pay versions of this auction. In the winner-pay version, a bid that does not win an object is refunded. In the all-pay version, all bids are forfeited. Szentes and Rosenthal 2003b extend this analysis to a related n-player game in which each player s objective is to secure a super-majority of auction wins. The model we examine here differs in that the objective-based linkages are asymmetric across players. 6 Our model features an environment in which random noise plays little role in determining the outcomes at the nodes at each node the player with the larger resource expenditure for the node wins the node with certainty. 7 Closely related is the literature on simultaneousmove multidimensional resource allocation games in which the conflict at each node features a softer form of competition that emphasizes the role of random noise in determining the outcomes at the nodes. 8 For example, under the Tullock contest success function henceforth, CSF the probability that a player wins a node is equal to the ratio of the player s resource 5 In a related attack and defense game, Bernhardt and Polborn 2010 examine a cost-based asymmetry between attack and defense. In that case, the committed attacker experiences no opportunity costs from allocating forces and continues attacking targets until either he runs out of targets or is defeated. lso related is Kovenock, Sarangi, and Wiser 2015 which examines a modified form of the board game Hex in which a contest arises at each cell on the board with the contest winner determined by the Tullock contest success function. 6 See Kovenock and Roberson 2012 for a survey of cost- and objective-based linkages in multidimensional resource allocation games. See also rce, Kovenock and Roberson 2012 which examines a related game with multiple attack technologies. 7 This corresponds to the limiting case of the general ratio-form contest success function a m /a m + d m where m is set to and a and d are the two players allocations of force. The parameter m R + is inversely related to the level of noise in the conflict: low values imply a large amount of noise and high values correspond to low or no noise. Because for a single contest with linear costs pure-strategy equilibria fail to exist for all m greater than 2 and there exist equilibria in one-shot contests that are payoff equivalent to the m = case whenever m > 2 Baye, Kovenock, e Vries 1994, lcalde and ahm 2010, the case of m = is viewed as an important theoretical benchmark that is relevant for all m > 2. 8 See for example Snyder 1989 and Klumpp and Polborn 2006 which examine related games featuring the symmetric majoritarian objective in the context of politicians engaged in a campaign resource allocation game. 4

7 expenditure at the node to the sum of all of the players expenditures at the node. The case of the attack and defense of a network in which each minimal cut set consists of a single node with the outcome at each node determined by the Tullock CSF is examined by Clark and Konrad 2007, who find that under this softer form of competition the attacker optimally chooses a complete coverage strategy in which each and every node that is a minimal cut set is attacked with certainty. In contrast, we find that when the factors influencing node outcomes are explicitly captured in the model, with unmodeled factors or noise playing little or no role, attackers utilize a stochastic guerilla warfare strategy in all equilibria. For the special case in which the network consists of only singleton minimal cut sets, this involves a single random node that is a cut set being attacked, but with a positive probability that each cut set is chosen as the one to be attacked. 9 Section 2 presents the model of attack and defense with network connectivity. Section 3 characterizes a Nash equilibrium in mixed strategies and explores properties shared by all Nash equilibrium mixed strategies. Section 4 concludes. 2 The Model Players The model is formally described as follows. Two players, an attacker,, and a defender,, simultaneously allocate their forces across the n 2 nodes in the network G = N, E with node-set N and edge-set E. G is a connected network, and thus, there exists at least one path between every pair of nodes in N. network is said to be disconnected if it is not connected. For a connected network G, a node cut set is a set of nodes C N whose removal from G results in a disconnected network. minimal cut set is a cut set satisfying the property that no proper subset forms a cut set. Let B denote the index set consisting of indices for all minimal cut sets of network G. Let N j denote the index set consisting of indices for all nodes in minimal cut set j B, and let n j N j denote the number of nodes in minimal 9 Kovenock, Roberson, and Sheremeta 2010 experimentally examine behavior in a specification of the game of attack and defense of a network with only singleton minimal cut sets where the conflict at each target is modeled either by the Tullock CSF or the specification given in this paper, the auction CSF. Consistent with the theoretical prediction under the auction CSF, attackers utilize a stochastic guerilla warfare strategy in which a single random node is attacked more than 80% of the time. Under the lottery CSF, attackers utilize the stochastic guerilla warfare strategy almost 45% of the time, in contrast to the theoretical prediction that the attacker covers all of the nodes, which is observed less than 30% of the time. 5

8 cut set j. Figure 1 provides three examples a tree network, a core-periphery network, 10 and an arbitrary network with their respective minimal cut sets. Note that in each of these examples the corresponding minimal cut sets are disjoint. In the results section we focus first on networks with disjoint minimal cut sets, and then show how these results can be extended to networks with overlapping minimal cut sets. a Tree Network b Core-Periphery Network c rbitrary Network Figure 1: Example Networks with isjoint Minimal Cut Sets minimal cut set is successfully defended if the defender allocates at least as high a level of force as the attacker to at least one node within the set. Conversely, an attack on a minimal cut set is successful if the attacker allocates a strictly higher level of force than the defender to each node in the set. Let x i xi denote the level of force allocated by the attacker defender to node i. For each j B define 1 if i N ι j j x i = > xi. 0 otherwise Observe that for each node, the player that allocates the strictly higher level of force wins that node with ties going to the defender, but in order to win the minimal cut set the 10 Here we use the definition of a core-periphery network from Bramoullé 2007: in a core-periphery network the node set E can be partitioned into two subsets, core nodes and periphery nodes, such that each core node is directly connected to all other core nodes, while each periphery node is connected to one core node and is not connected to any periphery node. 6

9 attacker must win all of the nodes. The players are risk neutral and have asymmetric objectives. The attacker s objective is to successfully attack at least one minimal cut set, and the attacker s payoff for the successful attack of at least one minimal cut set is v > 0. The attacker s payoff function is given by {ι j π x, x = v max } x i j B. i N The defender s objective is to preserve connectivity, and the defender s payoff for successfully defending connectivity is v > 0. The defender s payoff function is given by {ι j π x, x = v 1 max } x i j B. i N For each player, the force allocated to each node must be nonnegative. Because nodes that are not contained in any minimal cut set N \ j B N j do not factor into the players payoff functions except insofar as resources may be wasted on them, it is clear that in any equilibrium x i = xi = 0 for all i N \ j B N j. Henceforth, we restrict our focus to the set of nodes that are contained in the union of the minimal cut sets, denoted by N j B N j, with n N denoting the number of such nodes. It is important to note that our formulation utilizes an auction contest success function. 11 It is well known that, because behavior is invariant with respect to positive affine transformations of utility, all-pay auctions in which players have different constant unit costs of resources may be transformed into behaviorally equivalent all-pay auctions with identical unit costs of resources, but suitably modified valuations. This result extends directly to the environment examined here, and thus, our focus on asymmetric valuations also covers the case in which the players have different constant unit costs of resources. lso observe that in the formulation described above the network features a weakest-link exposure problem for the defender. That is, if the defender loses a single minimal cut set then connectivity is lost. Conversely, each minimal cut set features best-shot redundancy in that the minimal cut set is successfully defended if the defender wins at least one node in the set. 11 See Baye, Kovenock, and de Vries

10 Strategies It is clear that there is no pure-strategy equilibrium for this class of games. For player k {, }, a mixed strategy is an n-variate distribution function P k : R n + [0, 1] with onedimensional marginal distribution functions {Pk i} i N, one univariate marginal distribution function for each node i N. The n-tuple of player k s allocation of force across the n nodes is a random n-tuple drawn from the n-variate distribution function P k. Model of ttack and efense of Network Connectivity The model of attack and defense of network connectivity, which we label N {G, v, v }, is the one-shot game in which players compete by simultaneously announcing mixed strategies, each node is won by the player that provides the higher allocation of force for that node, ties are resolved as described above, and players payoffs, π and π, are specified above. 3 Results It is useful to introduce a simple summary statistic that captures both the asymmetry in the players valuations and the structural asymmetries arising from the network structure. efinition 1. Let α = v /v [ j B defender. 1 n j ] denote the normalized relative strength of the Several properties of this summary statistic should be noted. First, the normalized relative strength of the defender is increasing in the relative valuation of the defender to the attacker v /v and, for each minimal cut set j B, is increasing in the number of nodes or best-shot redundancy n j in cut set j. In particular, the normalized relative strength of the defender is increasing in the total best-shot redundancy arising in G, as measured by 1/ 1 j B n j. For all G with disjoint minimal cut sets, Theorem 1 establishes the uniqueness of: i the players equilibrium expected payoffs and ii the players sets of univariate marginal distributions. Theorem 1 also provides a pair of equilibrium mixed strategies. Case 1 of Theorem 1 examines the parameter configurations for which the defender has a normalized relative strength advantage, i.e. α 1. Case 2 of Theorem 1 addresses the parameter 8

11 configurations for which the defender has a normalized relative strength disadvantage, i.e. α < 1. It is important to note that the stated equilibrium mixed strategies n-variate distributions are not unique. However, in Propositions 1-3 we characterize properties of optimal attack and defense that hold in all equilibria. Theorem 1. For any parameter configuration of the game N{G, v, v } in which G has disjoint minimal cut sets there exists a Nash equilibrium. Moreover, there exists a unique set of Nash equilibrium univariate marginal distributions and a unique equilibrium payoff for each player. 1 If α 1, then for each j B and i N j, player s univariate marginal is, for x i [0, v nj ], P i Similarly, player s univariate marginal is x i = 1 v n j v + xi v. P i x i = 1 1 n j + xi v. The expected payoff for player is 0, and the expected payoff for player is v 1 1 α. 2 If α < 1, then for each j B and i N j, player s univariate marginal is, for x i [0, αv n j ], P i Similarly, player s univariate marginal is x i = 1 αv n j v + xi v. P i x i = 1 α n j + xi v. The expected payoff for player is 0, and the expected payoff for player is v 1 α. One Nash equilibrium of N{G, v, v } is for each player to allocate his forces according to the following n-variate distribution functions: 1 If α 1, then for player and x j B [0, v nj ] n j P x = 1 1 α + j B min i N j {x i } v. 9

12 Similarly for player and x j B [0, v nj ] n j P x = min { i N j x i v } j B. 2 If α < 1, then for player and x j B [0, αv n j ] n j P x = Similarly for player and x j B [0, αv n j ] n j j B min i N j {x i } v. { i N P x = 1 α + min j x i } v Proof. The proof of the uniqueness of the players equilibrium expected payoffs and sets of univariate marginal distributions is given in the ppendix. We now establish that the pair of n-variate distribution functions given in case 1 constitute an equilibrium for α 1. The proof of case 2 is analogous. The ppendix see the proof of Proposition 1 establishes that in any n-tuple drawn from any equilibrium n-variate distribution P player allocates a strictly positive level of force to at most one minimal cut set. lthough not a necessary condition for equilibrium, the P described in Theorem 1 displays the property that for the minimal cut set which receives the strictly positive level of force the force allocated to each node in that set is an almost surely increasing function of the force allocated to any other node in that cut set. The ppendix see the proof of Proposition 1 also establishes that in any n-tuple drawn from any equilibrium n-variate distribution P player allocates a strictly positive level of force to at most one node in each minimal cut set. We will now show that, for each player, each point in the support of their equilibrium n-variate distribution function, P or P, given in case 1 of Theorem 1 results in the same expected payoff, and then show that there are no profitable deviations from this support. 12 When x i > 0 for every i N j, the probability that player wins every node in minimal cut set j B is given by the n j -variate marginal distribution P {x i } i N j, {{ v nj } i N j } j B j j, which we denote as P N j {xi } i N j. Given that player is using the equilibrium strategy P 12 Except for possibly at points of discontinuity of his expected payoff function, each player k must make his equilibrium expected payoff at each point in the support of his equilibrium strategy, P k. j B. 10

13 described above, the payoff to player for any allocation of force x R n + which allocates a strictly positive level of force only to the nodes in minimal cut set j B, and allocates zero force to every other node is π x, P = v P N j {x i } i Nj i N j x i. Simplifying, i N π x, P = v j x i x i = 0. v i N j Thus, the expected payoff to player from allocating a strictly positive level of force to only one minimal cut set is 0 regardless of which minimal cut set is attacked. For player, the only possible payoff increasing deviation from his mixed strategy is to allocate a strictly positive level of force to two or more minimal cut sets. Beginning with the case in which player attacks two minimal cut sets j, j B with x i > 0 for every i N j N j, the probability that player wins all of the nodes in both cut sets j, j B is given by the n j + n j -variate marginal distribution P {x i } i N j N j, {{ v } n j i N j } j B j j,j, which we denote as P N j,n j {x i } i N j N j. The payoff to player for any allocation of force x R n + which allocates a strictly positive level of force to every node in exactly two minimal cut sets j, j B is π x, P = v P N j {x i } i Nj + v P N j {x i } i Nj v P N j,n j {x i } i Nj N j x i. i N j N j Simplifying, π x, P = v min { } i N j x i i N, xi j < 0. v v The case of player allocating a strictly positive level of force to more than two minimal cut sets follows directly. Clearly, in any optimal strategy player never allocates a strictly positive level of force to more than one minimal cut set. The case for player follows along similar lines. If player allocates a strictly positive level of force to a subset φ N of nodes with one node, denoted φ j, from each minimal cut set j B, then the probability that player preserves connectivity is given by P {x i } i φ, {{ v nj } i Nj \φ j } j B, which we denote as P φ {xi } i φ. 11 Given that player is

14 using the equilibrium strategy P described above the payoff to player for any allocation of force x R n + which allocates a strictly positive level of force to only the nodes in the set φ is π x, P = v P φ {xi } i φ x i. i φ Simplifying, and thus π x, P = v 1 1 i φ + v xi x i α v i φ π x, P = v 1 1 α for all x in which a strictly positive level of force is allocated to each node in some set φ N of nodes with one node from each minimal cut set j B. Following lines similar to those given above in the demonstration that player attacks at most one minimal cut set see the proof of Proposition 1 in the ppendix for further details, player cannot increase his expected payoff by deviating to an allocation with a strictly positive level of force at two or more nodes within one or more minimal cut sets. lthough the equilibrium mixed strategies stated in Theorem 1 are not unique, 13 it is useful to provide some intuition regarding the existence of this particular equilibrium before moving on to the characterization of properties of optimal attack and defense that hold in all equilibria Propositions 1-3. The supports of the equilibrium mixed strategies stated in Theorem 1 are given in Figure 2 in an example with a specific parameter configuration. Panels a and b of Figure 2 provide the supports for the attacker and defender, respectively, in the case in which there are two minimal cut sets each with one node i = 1, 2. Panels c and d of Figure 2 provide the supports for the attacker and defender, respectively, in the case in which there is one minimal cut set with two nodes i = 1, 2 and one minimal cut set with one node i = 3. cross all of the Panels a-d, if α = 1 then each player randomizes continuously over their respective shaded line segments. In the event that the defender has a normalized relative strength advantage α > 1, the defender s strategy stays the same, but the attacker 13 For example, in the case 1 parameter range of Theorem 1 another equilibrium strategy for player is to use the mixed strategy P x = { } i N j x i. v j B 12

15 x 2 Network with two minimal cut sets, each with one node i =1, 2 x 2 ṽ ṽ x 1 x 1 ṽ ṽ a ttacker b efender Network with two minimal cut sets, one with two nodes i =1, 2 and one with one node i =3 x 2 x 2 ṽ 2 ṽ 2 ṽ 2 x 1 ṽ 2 x 1 ṽ ṽ x 3 c ttacker x 3 d efender Figure 2: Supports of the Theorem 1 pair of equilibrium mixed strategies ṽ = min{αv,v }. 13

16 now places a mass point of size 1 1/α at the origin and randomizes continuously over the respective line segments with the remaining probability. Conversely, if the defender has a normalized relative strength disadvantage α < 1, then it is the defender who places a mass point of size 1 α at the origin. Beginning with Panels a and b, recall that if the attacker successfully attacks a single minimal cut set the network is disconnected. s shown in Panel a the support of the attacker s equilibrium mixed strategy, P, lies on the axes, and, thus, the attacker launches an attack on at most one minimal cut set. To successfully defend a set of singleton minimal cut sets, the defender must win every node within the set. s shown in Panel b the support of the defender s Theorem 1 equilibrium mixed strategy, P, lies on the 45 line, and, thus, the defender s allocation of force to node i is an almost surely strictly increasing function of the force allocated to node i. Note that if the attacker launches an attack on at most one minimal cut set, then the probability that any single attack is successful depends only on the univariate marginal distributions of the defender s mixed strategy an n-variate joint distribution. In addition, the defender s expected force expenditure depends only on his set of univariate marginal distributions, and, for a given set of univariate marginal distributions, is invariant to the correlation structure. 14 Finally, note that given the defender s choice of correlation structure [Panel b], the attacker s probability of at least one successful attack depends only on the maximum of his force allocations across the two nodes. That is, given the defender s equilibrium mixed strategy, if the set of points such that x i x i > 0 for some i {1, 2} has positive measure, then the attacker can strictly increase his expected payoff by reducing x i to x i = 0 for all such points. In such a deviation, the probability of at least one successful attack is unaffected, but the attacker s expected force expenditure decreases. Thus, at each point in the support of the equilibrium mixed strategy the attacker launches at most one attack. Panels c and d examine a simple network with one minimal cut set with two nodes and one minimal cut set with one node. In Panel c, note that the attacker launches an attack on at most one minimal cut set. In the event in which the minimal cut set with two nodes is attacked, the attacker s allocation of force to node i in the cut set is an almost surely strictly increasing function of the force allocated to node i in the cut set. In Panel d, note that for this parameter configuration there are two spanning trees of the network and the defender randomly chooses a spanning tree to protect by allocating a strictly positive 14 More formally, for a given set of univariate marginal distribution functions, the expected force expenditure is invariant to the mapping into a joint distribution function, i.e. the n-copula. For further details see Nelsen

17 level of force to at most one of the nodes i {1, 2} in the minimal cut set with two nodes and choosing to set the level of force allocated to the single node in the remaining minimal cut set as an almost surely increasing function of the level of force allocated to the minimal cut set with two nodes. That is, the force allocated to each node in the randomly chosen spanning tree is an almost surely strictly increasing function of the level of force allocated to the other node in the spanning tree. Given these correlation structures, the intuition for why the attacker launches an attack on at most one minimal cut set in the network follows along the lines given above for the network with singleton minimal cut sets. We have already pinned down equilibrium payoffs and univariate marginal distributions arising in all equilibrium mixed strategies. We now characterize several other qualitative features arising in all equilibria. Proposition 1 examines the number of minimal cut sets that are simultaneously attacked as well as the number of nodes within each minimal cut set that are simultaneously attacked and defended. Propositions 2 and 3 examine the likelihood that the defender leaves the network undefended, the likelihood that the attacker launches an attack on the network, and conditional on an attack, the likelihood that a given minimal cut set j B is attacked. Formal proofs for Propositions 1-3 are given in the ppendix. Proposition 1. In any equilibrium {P, P } of the game N{G, v, v } with disjoint minimal cut sets: 1 If x is an n-tuple contained in the support of P, then x allocates a strictly positive level of force to at most one minimal cut set. 2 If x is an n-tuple contained in the support of P, then x allocates a strictly positive level of force to at most one node within each minimal cut set. For intuition on part 1 of Proposition 1, recall that success for the attacker requires winning at least one minimal cut set. Because attacking multiple cut sets is costly, it must be the case that doing so increases the probability of success. Then note that the defender has the ability to utilize correlation structures in his mixed strategy for which the attacker s probability of success is non-increasing as the number of minimal cut sets that are attacked increases. For example in the equilibrium strategies given in part 1 of Theorem 1 the defender randomly chooses one node from each minimal cut set to defend and the mixed strategy specifies that across this set of nodes the allocation of force has perfect positive correlation. Given that in equilibrium the defender employs such a strategy, the attacker allocates a strictly positive level of force to at most one minimal cut set. The intuition for part 2 of Proposition 1 follows along similar lines. In particular, the attacker now has 15

18 the ability to utilize a mixed strategy for which the defender s probability of successfully defending the cut set is non-increasing as the number of defended nodes in the cut set increases. Proposition 2. If α 1, then in any equilibrium {P, P } of the game N{G, v, v } with disjoint minimal cut sets: 1 With probability 1 1, the network is not attacked. α 2 Conditional on an attack on the network, the probability that player attacks minimal cut set j B is 1/n j [ j B set j. 1 ], which is decreasing in the number of nodes in cut n j 3 Player allocates a strictly positive level of force to each minimal cut set j B with certainty. For α > 1, the normalized relative strength of the defender is high enough that all equilibria involve the attacker refraining from attack with positive probability. Conversely, the defender defends the network with certainty. Because each minimal cut set j provides the defender with a form of best-shot redundancy in proportion to the number of nodes, n j, in cut set j, larger minimal cut sets are more difficult to successfully attack. Conditional on launching an attack on the network, the probability that minimal cut set j is attacked is decreasing in the number of nodes n j. Proposition 3 addresses the case of α < 1. In this case, the attacker optimally launches an attack with certainty and the defender leaves the network undefended with positive probability. Proposition 3. If α < 1, then in any equilibrium {P, P } of the game N{G, v, v } with disjoint minimal cut sets: 1 The network is attacked with certainty. 2 The probability that player attacks minimal cut set j B is 1/n j [ 1 j B ], which n j is decreasing in the number of nodes in cut set j. 3 Player leaves the network undefended with probability 1 α and, with probability α, allocates a strictly positive level of force to every cut set j B. 16

19 If α < 1, then the normalized relative strength of the defender is sufficiently low that all equilibria involve the defender leaving the network undefended with positive probability, and the likelihood that the defender leaves the network undefended is decreasing in the normalized relative strength of the defender. To summarize, the following conditions hold in all equilibria. If α > 1, then in any equilibrium the attacker chooses, with positive probability, not to launch an attack. Regardless of the value of α, the attacker launches an attack on at most one minimal cut set. Conditional on an attack, the likelihood that any individual minimal cut set is attacked depends on the number of nodes within the minimal cut set. For each minimal cut set the likelihood of attack is decreasing in the number of nodes. If α < 1, then in any equilibrium the defender leaves the network undefended with positive probability. Lastly, regardless of the value of α, conditional on the network being defended, the defender randomly chooses one node within each minimal cut set to defend, i.e. the defender chooses a random spanning tree to defend. Figure 3 below illustrates in the case of network c from Figure 1 how randomizing over which node in each minimal cut set to defend is equivalent to randomizing over defense of a spanning tree. In this example there exist two singleton minimal cut sets and a minimal cut set with three nodes. For each of the nodes in the non-singleton minimal cut set Figure 3 provides the corresponding spanning tree that is implicitly preserved if each of the defended nodes are preserved, where the defended nodes are surrounded by a dashed circle and the undefended nodes are denoted by hollow nodes. Note that if one or both of the undefended nodes are destroyed the network is still connected by the spanning tree that is created by the nodes that are defended. Networks with Overlapping Minimal Cut Sets Figure 4 provides two examples of networks with overlapping minimal cut sets. In cases such as in panel a of Figure 4 where the overlapping minimal cut sets are symmetric with respect to the number of nodes in each cut set, it is straightforward to extend the specific pair of equilibrium mixed strategies in Theorem 1. If, as in panel b of Figure 4, the overlapping minimal cut sets differ with respect to the number of nodes, then it may be possible to judiciously extend the specific pair of equilibrium mixed strategies in Theorem 1 to cover this case, but this extension will depend critically on the network structure. Beginning with the case of cycle networks as in panel a of Figure 4, consider an arbitrary cycle network with n 4 nodes. Let the nodes be sequentially indexed clockwise from 1 to n. The following corollary provides an extension of the mixed strategies in Theorem 1 17

20 Figure 3: Randomly efended Spanning Trees a Cycle Network b rbitrary Network Figure 4: Example Networks with Overlapping Minimal Cut Sets 18

21 that applies to cycle networks. In constructing the equilibrium, define α = the index i + 2 refer to i + 2mod n. v v n/2 and let Corollary 1. For any parameter configuration of the game N{G, v, v } with G a cycle network, there exists an equilibrium in which each player allocates his forces according to the following n-variate distribution functions: 1 If α 1, then for player and x [0, v 2 ] n P x = 1 1 α + i N min{xi, x i+2 } v Similarly for player and x [0, v 2 ] n 2 mini N x i P x = In this equilibrium, the expected payoff for player is 0, and the expected payoff for player is v 1 1 α. 2 If α < 1, then for player and x [0, α v 2 ] n P x = Similarly for player and x [0, α v 2 ] n v i N min{xi, x i+2 } v 2 P x = 1 α mini N x i + In this equilibrium, the expected payoff for player is 0, and the expected payoff for player is v 1 α. For a cycle network, any pair of nonadjacent nodes forms a minimal cut set, the destruction of which disconnects the network. In the following comments, we provide a sketch of the proof that the mixed strategies in Corollary 1 form an equilibrium but omit the arguments ruling out the attack of multiple minimal cut sets which follow along the same line as in the proof of Theorem 1. If α 1, then the expected payoff to the attacker from attacking any v 19

22 pair of nonadjacent nodes i and i = i + 2mod n with x i, xi [0, v 2 ] 2 is 2 min{x i v, x i } x i x i 0 1 v which holds with equality if x i = xi. In the mixed strategy equilibrium identified in Corollary 1, the attacker chooses a random node i and its first nonadjacent node i in a clockwise direction to attack, and sets x i = xi at each point in the support. Thus, 1 holds with equality at each point in the support of the attacker s equilibrium mixed strategy. When α 1 the defender s Corollary 1 equilibrium mixed strategy specifies that the allocation to each node i in the network is strictly positive and is an almost surely strictly increasing function of the allocation to each other node. Specifically, at each point in the support of the defender s Corollary 1 equilibrium mixed strategy x i = xi for all i, i N. If the defender defends each node i in the network with x i 0, v 2 ], then the defender s expected payoff is } v 1 1 α + i N min{xi, xi+2 v i N x i v 1 1 α which holds with equality if x i = xi+2 for all i as in the support of the defender s Corollary 1 mixed strategy. nd, given the attacker s Corollary 1 equilibrium mixed strategy, there exist no profitable deviations for the defender. The case of α < 1 follows along similar lines. s noted, the panel b network in Figure 4 illustrates that when minimal cut sets overlap and differ with respect to the number of nodes that they contain, the qualitative nature of Nash equilibrium may depend critically on the details of the network structure. Nonetheless, it may be possible to derive a Nash equilibrium profile. In the case of the network in panel b, let the nodes be sequentially indexed left to right with any nodes equidistant from the leftmost node being indexed from top to bottom from 1 to n. Note that in panel b, the 4 minimal cut sets are 2, 3, 2, 4, 6, 5, and 7, and thus, nodes 1 and 8 are never attacked or defended. Let x = x 2, x 3, x 4, x 5, x 6, x 7 R 6 + be a 6-tuple that corresponds to the allocation of force to nodes 2-7, and for this network define α = 3v 8v. Corollary 2. For any parameter configuration of the game N{G, v, v } with G given by panel b of Figure 4, there exists an equilibrium in which each player allocates his forces according to the following n-variate distribution functions: 20

23 1 If α 1, then for player and x [0, 2v 3 ] [0, v 3 ] [0, v 6 ] [0, v ] [0, v 6 ] [0, v ] { } { } P x = 1 1 x min 2, α + 2 x3 x + min 2, 2 x4 + x 6 + x 5 + x 7. v Similarly for player and x [0, 2v 3 ] [0, v 3 ] [0, v 6 ] [0, v ] [0, v 6 ] [0, v ] min{x 2 + min{x 3, x 4 + x 6 }, x 5, x 7 } P x =. In this equilibrium, the expected payoff for player is 0, and the expected payoff for player is v 1 1 α. 2 If α < 1, then for player and x [0, 2α v ] [0, α v ] [0, α v ] [0, α v ] [0, α v ] 6 [0, α v ] { } { } x min 2, 2 x3 x + min 2, 2 x4 + x 6 + x 5 + x 7 P x =. v Similarly for player and x [0, 2α v ] [0, α v ] [0, α v ] [0, α v ] [0, α v ] 6 [0, α v ] min{x P x = 1 α 2 + min{x 3, x 4 + x 6 }, x 5, x 7 } +. In this equilibrium, the expected payoff for player is 0, and the expected payoff for player is v 1 α. To preserve a spanning tree in panel b of Figure 4, the defender must win nodes 5 and 7, combined with either node 2 or a combination of node 3 with node 4 and/or node 6, which is exactly what happens in the support of the equilibrium mixed strategy for the defender in Corollary 2. If α 1 and the defender only defends nodes 2, 5, and 7 with any x 2 0, 2v 3 ], and x 5, x7 0, v ] respectively, then the defender s expected payoff is v 1 1 α + x2 + x5 + x7 x 2 x 5 x 7 = v 1 1α. v Similarly, if only defends nodes 3 7 with any x 3 0, v 3 ], x 4, x6 0, v 6 ], and x 5, x7 0, v ] respectively, then the defender s expected payoff is v 1 1 α + x3 + x4 + x6 + x5 + x7 x 3 x 4 x 6 x 5 x 7 = v 1 1α. v 21 v v

24 Recall that the 4 minimal cut sets are 2, 3, 2, 4, 6, 5, and 7. Consistent with part 1 of Proposition 1, at each point in the support of s Corollary 2 equilibrium mixed strategy attacks at most one minimal cut set. We focus on the case in which the 2, 3 minimal cut set is attacked, and note that the three remaining cases follow along similar lines. If α 1, then the expected payoff to the attacker from attacking nodes 2 and 3 with x 2, x3 [0, 2v 3 ] [0, v 3 ] is x 2 v + x 3 x 2 x 3 = 0. v s in the case of disjoint minimal cut sets, in both of the examples in Figure 4 the corresponding Corollary 1 and 2 equilibrium mixed strategies involve the defender choosing a random spanning tree to defend and the attacker choosing a random minimal cut set to attack. 4 Conclusion This paper examines a game-theoretic model of attack and defense of network connectivity. The model features asymmetric objectives: the defender wishes to successfully defend network connectivity and the attacker s objective is to successfully attack at least one minimal cut set. lthough the model allows for general correlation structures for force expenditures within and across the nodes, for the case in which the minimal cuts sets are disjoint we derive the unique equilibrium expected payoffs of the attacker and defender and demonstrate that there exists a unique equilibrium univariate marginal distribution of forces to each node. n equilibrium pair of mixed strategies for the attacker and defender, each of which is a joint distribution governing the allocation of forces to all nodes, is also constructed, although these are generally non-unique. Our approach leads to a wealth of interesting extensions and applications. Because the game examined here is a set of complete information all-pay auctions linked by payoff complementarities, almost any extension of the standard one-dimensional strategic allocation problem represented by the standard all-pay auction with complete information has a corresponding extension in this game. Examples include incomplete information about values or unit costs of forces, affine handicapping of players within contests at nodes, and nonlinear costs of forces. 15 In addition, as in other models of strategic multidimensional resource 15 Examples of these extensions for the one-dimensional strategic allocation problem include mann and 22

25 allocation, such as Colonel Blotto games, interesting extensions arise by introducing more heterogeneity across nodes, such as allowing for differential node values for the attacker and defender within the network structure, or other factors that might link allocations across nodes, such as budget constraints or infrastructure technologies that allow lumpy force expenditure across sets of nodes. lthough this general research agenda is in its early stage, we believe these issues deserve further development. References [1] lcalde, J., and M. ahm 2010, Rent seeking and rent dissipation: a neutrality result, Journal of Public Economics 94:1-7. [2] mann, E., and W. Leininger 1996, symmetric all-pay auctions with incomplete information: the two-player case, Games and Economic Behavior 14:1-18. [3] rce,.g., Kovenock,., and B. Roberson 2012, Weakest-link attacker-defender games with multiple attack technologies, Naval Research Logistics 59: [4] Baye, M.R., Kovenock,., and C.G. de Vries 1994, The solution to the Tullock rent-seeking game when R > 2: mixed-strategy equilibria and mean dissipation rates, Public Choice 81: [5] Baye, M.R., Kovenock,., and C.G. de Vries 1996, The all-pay auction with complete information, Economic Theory 8: [6] Bernhardt,. and M.K. Polborn 2010, Non-convexities and the gains from concealing defense from committed terrorists, Economic Letters 107: [7] Bier, V.M., Oliveros, S., and L. Samuelson 2007, Choosing what to protect: strategic defensive allocation against an unknown attacker, Journal of Public Economic Theory 9: [8] Borel, E. 1921, La théorie du jeu les équations intégrales à noyau symétrique, Comptes Rendus de l cadémie 173: ; English translation by L. Savage 1953, The theory of play and integral equations with skew symmetric kernels, Econometrica 21: Leininger 1996, Krishna and Morgan 1997, Moldovanu and Sela 2001, 2006, Gale and Stegeman 1994, Konrad 2002, Kaplan and Wettstein 2006, Che and Gale 2006, and Siegel